Identity Defense Alerts Associated with Historical Handling Information (IdentityWithHistoricalHandlingInformation)

Playbook Overview

If SecMaster receives new IAM alerts within 15 days after a similar type of IAM alert is closed, the IdentityWithHistoricalHandlingInformation playbook will add the comment for the closed IAM alert to the comment area of the new similar IAM alerts. This playbook is applied to alerts only. Attacks cannot trigger it. For details about the differences between alerts and attacks, see Overview.

If two IAM alerts meet any of the following conditions, they are similar alerts:

• Their attack source IP addresses are the same.
• Their usernames are the same.
• They belong to the same alert type.

You need to enable this playbook manually. This playbook is triggered when SecMaster receives new alerts from IAM and the new alerts are similar to a closed IAM alert.

Notes and Constraints

• Your SecMaster professional edition is available.
• The alert data source is IAM.

Enabling a Playbook

In SecMaster, the initial version (V1) of the IdentityWithHistoricalHandlingInformation workflow is enabled by default. You do not need to manually enable it. The initial version (V1) of the IdentityWithHistoricalHandlingInformation playbook is also activated by default. To use the playbook, you only need to enable it.

1. Log in to the SecMaster console.
2. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

3. In the navigation pane on the left, choose Security Orchestration > Playbooks.
4. On the Playbooks page, click Enable in the Operation column of the row containing the IdentityWithHistoricalHandlingInformation playbook.
5. In the dialog box displayed, select the initial playbook version v1 and click OK.

Implementation Effect

After the playbook is triggered, SecMaster adds the closure comments for similar closed alerts to new IAM alerts in SecMaster.

1. Log in to the SecMaster console.
2. Click in the upper left corner of the management console and select a region or project.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 2 Workspace management page
   

4. In the navigation pane on the left, choose Threats > Alerts.
   Figure 3 Alerts
   

5. On the Alerts page, search for IAM alerts by data source filter and click the name of a new IAM alert to go to the details page.
6. If there are closed similar alerts, the closure comments for the closed alerts will be automatically added to the comment area on the details page of the new IAM alert.

   If two IAM alerts meet any of the following conditions, they are similar alerts:

   • Their attack source IP addresses are the same.
   • Their usernames are the same.
   • They belong to the same alert type.

   After the IdentityWithHistoricalHandlingInformation playbook takes effect, the closure comments for the closed alerts will be automatically added to the comment area on the details page of the new similar IAM alerts.

   Figure 4 Adding a closure comment for a historical IAM alert to new similar alerts